From owner-freebsd-security@FreeBSD.ORG  Sat Oct  4 09:00:12 2003
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 24E4816A4B3
	for <freebsd-security@freebsd.org>;
	Sat,  4 Oct 2003 09:00:12 -0700 (PDT)
Received: from gw.celabo.org (gw.celabo.org [208.42.49.153])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 3B33643FE3
	for <freebsd-security@freebsd.org>;
	Sat,  4 Oct 2003 09:00:11 -0700 (PDT)
	(envelope-from nectar@celabo.org)
Received: by gw.celabo.org (Postfix, from userid 1001)
	id E55655485D; Sat,  4 Oct 2003 11:00:10 -0500 (CDT)
Date: Sat, 4 Oct 2003 11:00:10 -0500
From: "Jacques A. Vidrine" <nectar@FreeBSD.org>
To: "Bjoern A. Zeeb" <bzeeb-lists@lists.zabbadoz.net>
Message-ID: <20031004160010.GA96970@hellblazer.celabo.org>
Mail-Followup-To: "Jacques A. Vidrine" <nectar@FreeBSD.org>,
	"Bjoern A. Zeeb" <bzeeb-lists@lists.zabbadoz.net>,
	freebsd-security@freebsd.org
References: <200310032249.h93MnXS8047857@freefall.freebsd.org>
	<Pine.BSF.4.53.0310041506140.60080@e0-0.zab2.int.zabbadoz.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <Pine.BSF.4.53.0310041506140.60080@e0-0.zab2.int.zabbadoz.net>
X-Url: http://www.celabo.org/
User-Agent: Mutt/1.5.4i
cc: freebsd-security@freebsd.org
Subject: Re: FreeBSD Security Advisory FreeBSD-SA-03:18.openssl
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security issues [members-only posting]
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sat, 04 Oct 2003 16:00:12 -0000

On Sat, Oct 04, 2003 at 03:22:42PM +0000, Bjoern A. Zeeb wrote:
> Another question: can someone please confirm that mod_ssl.so from
> apache 2.0.47 port is _not_ affected ?

It _is_ affected, because it uses the affected portions of OpenSSL.

> I have rebuilt libssl, libcrypto and installed them (they all differ
> from the old libs after make install) and done a rebuild of
> mod_ssl. But the new mod_ssl.so doesn't differ from the one
> built late August:
> 
> [ports]apache2/work/httpd-2.0.47/modules/ssl/.libs> md5 mod_ssl.so
> MD5 (mod_ssl.so) = a4e31cf6e4aff5ca91f164d57eb68457
> 
> /usr/local/libexec/apache2> md5 mod_ssl.so
> MD5 (mod_ssl.so) = a4e31cf6e4aff5ca91f164d57eb68457
> 
> Also diff does not say that the binary files would differ.

mod_ssl.so uses dynamic linking.  It would not require a rebuild nor
would the compiler output necessarily change after a rebuild.

Cheers,
-- 
Jacques Vidrine   . NTT/Verio SME      . FreeBSD UNIX       . Heimdal
nectar@celabo.org . jvidrine@verio.net . nectar@freebsd.org . nectar@kth.se